What is CVE-2024-51961?

CVE-2024-51961 is a high-severity vulnerability in Esri Arcgis Server, classified under External Control of File Name or Path. CVSS score: 7.5/10. Published 2025-03-03.

How severe is CVE-2024-51961?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Esri Arcgis Server

CVE-2024-51961

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server. Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.

EPSS: 0.005 (38.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Esri Arcgis Server — versions all
Esri Arcgis_server

Weakness classification (CWE)

References

psirt@esri.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-51961?: CVE-2024-51961 is a high-severity vulnerability in Esri Arcgis Server, classified under External Control of File Name or Path. CVSS score: 7.5/10. Published 2025-03-03.
How severe is CVE-2024-51961?: High severity. CVSS v3 base score is 7.5 out of 10.